Isolate APIM between production and non-production

Question

Should we isolate APIM between different types of environments? What are the pros and cons of doing so?

Answer 1

@LH Thank you for reaching out to Microsoft Q&A. To answer your first question, the recommendation is to set up separate production and non-production environments and then set up a CI/CD pipeline as mentioned in docs: https://learn.microsoft.com/en-us/azure/api-management/devops-api-development-templates.

The below pros/cons are not specific to APIM but in general and can be applied to other resources as well.
Pros:
Creates a boundary between prod and non-prod environments which makes resource management safe.

• Apply different policies at the subscription level for policy compliance or enforce policies.
• Resource tagging and naming conventions, access management
• Apply different network security rules like NSG, route table, security zones etc.
• Also, multiple development teams might work in a development environment, with elevated permissions at a subscription or resource level and isolation helps them to elevate such risks or any security concerns.

Cons:
There might be an additional overhead in managing multiple subscriptions, policies, network rules etc. depends on enterprise/organization structure.

Looking at the architecture diagram attached, this provides a great isolation between PROD and NON-PROD APIM instances with different subscriptions and VNET(s). The pros and cons should apply very well for this. Do you have any specific questions other than the ones I listed? I am happy to help if you have any and feel free to add.